intelliworx.CredentialResolver (1.0.0)
Installation
dotnet nuget add source --name Public --username your_username --password your_token dotnet add package --source Public --version 1.0.0 intelliworx.CredentialResolverAbout this package
Resolves placeholders in the ASP.NET configuration with values of a password manager or credential store.
intelliworx Credential Resolver
A .NET library that resolves credential placeholders in ASP.NET Core configuration values at runtime using pluggable credential providers (e.g. Bitwarden, 1Password, or custom stores).
Instead of storing secrets directly in configuration files, you use URI-formatted placeholders like <<bitwarden://folder/my-secret>>. The library scans all configuration values and replaces these placeholders with the actual credentials fetched from the corresponding provider.
Installation
dotnet add package intelliworx.CredentialResolver
Quick Start
1. Implement a Credential Resolver
Create a class that implements ICredentialResolver for your credential store:
using intelliworx.CredentialResolver;
public class BitwardenResolver : ICredentialResolver
{
public string Name => "Bitwarden";
public string[] UriSchemes => ["bitwarden"];
public bool IsConnected()
{
// Check connectivity to Bitwarden
return true;
}
public string? ResolveEntry(Uri paramItemUri)
{
// Fetch the credential from Bitwarden using the URI path
var path = paramItemUri.AbsolutePath;
return BitwardenClient.GetSecret(path);
}
}
2. Register in the Configuration Pipeline
Add the credential substitution as the last configuration source so it can process all previously registered values:
var builder = WebApplication.CreateBuilder(args);
builder.Configuration.AddCredentialSubstitution(options =>
{
options.AddResolver(new BitwardenResolver())
.SetThrowExceptionOnMissingEntries(true);
});
3. Use Placeholders in Configuration
In your appsettings.json or any other configuration source:
{
"ConnectionStrings": {
"Default": "Server=db.example.com;Database=app;Password=<<bitwarden://database/prod-password>>"
},
"ExternalApi": {
"ApiKey": "<<bitwarden://api-keys/external-service>>"
}
}
At runtime, the placeholders are replaced with the resolved credential values before your application reads the configuration.
Placeholder Format
<<scheme://path/to/credential>>
- scheme — matches a registered
ICredentialResolverby itsUriSchemesproperty - path — passed as a
Urito the resolver'sResolveEntrymethod
Examples:
<<bitwarden://secrets/db-password>><<1password://vault/api-key>><<keyvault://my-vault.vault.azure.net/secrets/connection-string>>
API Reference
ICredentialResolver
Plugin interface for credential providers:
| Member | Description |
|---|---|
string Name |
Display name of the provider |
string[] UriSchemes |
URI schemes this resolver handles (e.g. ["bitwarden"]) |
bool IsConnected() |
Returns whether the credential source is reachable |
string? ResolveEntry(Uri paramItemUri) |
Resolves a credential from the given URI, returns null if not found |
CredentialProviderOptions
| Method | Description |
|---|---|
AddResolver(ICredentialResolver resolver) |
Registers a resolver plugin (fluent) |
SetThrowExceptionOnMissingEntries(bool value) |
If true, throws when a placeholder cannot be resolved (fluent) |
Extension Method
IConfigurationBuilder.AddCredentialSubstitution(Action<CredentialProviderOptions> configure)
Registers the credential substitution provider. Must be called last in the configuration chain.
Multiple Providers
You can register multiple resolvers for different credential stores:
builder.Configuration.AddCredentialSubstitution(options =>
{
options.AddResolver(new BitwardenResolver())
.AddResolver(new OnePasswordResolver())
.AddResolver(new AzureKeyVaultResolver())
.SetThrowExceptionOnMissingEntries(true);
});
Each placeholder is routed to the correct resolver based on its URI scheme.
Requirements
- .NET 9.0 or later
Microsoft.Extensions.Configuration>= 10.0.3
License
GNU Affero General Public License v3 (AGPL-3.0)
Copyright (C) Bastian Krauß